The conservation system

Before you can evaluate compliance on a capitalization table, you need the cap table to be correct.

A capitalization table is a conservation system. Shares are created (authorized), allocated (issued), held (outstanding), and sometimes destroyed (cancelled). At every point in time, the numbers must add up. Outstanding shares cannot exceed authorized shares. The sum of shares held by all shareholders must equal total outstanding shares. Options pools must account for every grant.

These are arithmetic invariants, and they are easy to violate when the cap table is a spreadsheet. Spreadsheet arithmetic is binary floating point, which represents whole-number share counts exactly but approximates the fractions around them – ownership percentages, per-share prices, conversion ratios – and the approximations compound down a column. Manual data entry introduces transcription errors. Parallel updates by different people create conflicting versions. The result is cap tables where ownership percentages do not sum to 100%, where authorized shares are less than outstanding shares, and where the number of shares held by individual shareholders does not match the total.

In a spreadsheet, these inconsistencies are embarrassing. In a system that makes legal determinations based on the cap table – was this issuance within the authorized limit? did this transfer push ownership past the disclosure threshold? – they are dangerous. A compliance evaluation built on an inconsistent cap table produces answers that are, at best, unreliable and, at worst, legally wrong.

The first requirement is therefore a ledger with conservation constraints checked at every write. Share counts and monetary amounts are exact decimals, and binary floating point appears nowhere on the path from entry to record. The constraints are few and exact: authorized is greater than or equal to outstanding plus reserved; the shares held across all shareholders sum to outstanding; fully diluted equals outstanding plus everything convertible into shares, counted under a convention that is part of the invariant. Options and warrants count at the full number of shares they can be exercised into. A convertible instrument counts at the share count its terms fix on the date of the write: a capped convertible note or SAFE (a simple agreement for future equity) converts at its cap. An instrument with neither a cap nor a price – a discount-only note or SAFE before the round that prices it – has no share count yet, so it is carried as a declared contingent line, present in the record and excluded from the total until a priced round fixes it. Without the convention the equality is not computable. With it, the equality is exact at every write.

The share class taxonomy

A corporation may have common shares, preferred shares, restricted stock, convertible notes and SAFEs, warrants, and options. Each type carries distinct legal characteristics that determine which compliance domains activate during issuance, transfer, and conversion.

Issuing common shares to an accredited investor is a different compliance event from issuing convertible notes to a retail investor. The securities law analysis is different. The tax treatment is different. The disclosure obligations are different. The corporate law requirements may or may not differ depending on the charter. A system that treats all shares identically – that has a single “issue shares” operation regardless of share class – will produce incorrect compliance evaluations for any class that deviates from the common stock default.

The taxonomy must therefore be closed: a fixed set of known types, each with defined compliance characteristics. An instrument that matches no type in the taxonomy is rejected at the boundary. The rejection is deliberate. The class, together with the action, determines which domains evaluate the event, so an unclassified instrument has no defined evaluation, and the safe response to an undefined evaluation is refusal, not a default.

Closure is what makes exhaustive evaluation possible. When the system encounters a share issuance, it matches the share class against the taxonomy and activates the corresponding compliance domains. Because the match is exhaustive over a closed set, and anything outside the set is refused before it reaches the record, there is no case where a share issuance silently skips compliance evaluation because its type was not anticipated.

The security lifecycle

Individual securities – the specific instruments held by specific shareholders – progress through a typed lifecycle: a closed set of states, each stating which operations it permits.

An active security can be transferred. A cancelled security cannot. An expired option cannot be exercised. A converted note no longer exists as debt. These constraints are enforced at the type level: the security’s status is a variant of a closed enumeration, and every operation that touches a security must pattern-match on the status and handle every variant.

Adding a new status to the lifecycle – say, “frozen” for securities subject to a regulatory hold – forces an explicit decision at every handler in the system, because code that does not account for the new status no longer compiles. This is a totality check, not a proof of correctness: a handler can still decide wrongly, but it cannot silently fail to decide. When every operation must handle every state, the system cannot ignore a state it does not understand.

A vesting schedule is a deterministic function: given the grant date, the cliff, the vesting period, and the current date, the fraction vested is computable. The schedule terms are therefore the source of truth. A stored vested amount is a useful projection, and it is permitted on one condition: it is reconciled against the value computed from the schedule whenever it is read or written, so the schedule always wins. A mutable “percent vested” field that someone updates periodically, with nothing to reconcile it against, is how cap tables drift.

The transfer log and the ownership graph

Ownership gives rise to two objects, and the design must keep them distinct.

The first is the transfer log: an append-only record of transfer events between entities – persons and institutions. Every transfer produces an immutable entry. A transfer that turns out to have been mistaken is corrected by a typed reversal entry that references the original – not by deleting the original, and not by an ordinary transfer in the opposite direction, which would be indistinguishable from new economic activity. The log only grows. This mirrors the legal reality: in corporate law, a share transfer that occurred is a fact. It may later be rescinded, voided, or reversed, but the rescission is itself a legal event, not an erasure of the original event. The log records both.

The second object is derived from the first: a directed graph of net positions, where nodes are entities and edges are current economic interest. A typed reversal nets to zero here – the mistaken transfer and its reversal cancel, and the graph shows what is actually held. This is the object on which aggregate analysis runs: beneficial ownership concentration (has any node accumulated a position above a disclosure threshold?), control chains (does a path of holdings concentrate effective control in one hand?), sanctions exposure (what interest do persons under a sanctions block hold in each node, summed along the attested holdings?), circular flows (do interests cycle back to their source?).

The separation is what makes both objects coherent. Run cycle detection on the raw log and every corrected mistake reads as a circular flow. Run an audit on the netted graph and the history is gone. The log is the audit object; the graph is the analysis object; the typed reversal is the bridge that makes a correction visible in the first and neutral in the second.

One further distinction keeps the analysis honest. Each entry in the log is attested: someone with authority recorded the transfer and answers for it. The analyses on the graph then divide by what they add to the entries. Aggregate ownership adds arithmetic and nothing else: the interest that blocked persons – persons whose property a sanctions regime has frozen, beginning with those it lists by name – hold in an entity is a sum along attested holdings, and sanctions law makes the sum itself the operative fact. Under the United States rule, an entity in which blocked persons directly or indirectly own, individually or in the aggregate, an interest of fifty percent or more is a blocked person whether or not its name appears on any list (31 C.F.R. § 594.412 codifies the rule for one program; the Office of Foreign Assets Control’s revised guidance of 13 August 2014 applies it across programs). The blocked set is therefore computed, not attested, and the computation is exact: start from the listed persons, add every entity in which the set so far holds an aggregate interest at the threshold, and repeat until nothing is added. Membership in that set establishes sanctions applicability with the full force of the entries it was summed from, and the fail-closed evaluation described below takes it from there. The relations the graph analysis infers – that holdings chain into control, that parties act in concert – are attested by no one and summed from nothing, and the rule above speaks to ownership, not control. A finding of that kind is a classifier’s output, with a classifier’s error rate, and it raises a flag for evaluation rather than blocking the write by itself. A block is warranted where an authority attested the fact, or where the law makes arithmetic over attested facts a fact in its own right; no authority attested the inferred relation.

Corporate actions as state transitions

A stock split, a name change, an authorized shares increase, a dividend declaration, a board change, a dissolution – these are corporate actions, and they are the most complex mutations a capitalization table can undergo.

The complexity is not in the mechanics. A stock split multiplies share counts by a ratio. A dividend distributes a fixed amount per share. The mechanics are arithmetic. The complexity is in the compliance surface area.

Consider an authorized shares increase. The board must approve it (corporate governance). Shareholders may need to ratify it (corporate law). The increase may trigger securities registration requirements if the new shares will be offered publicly (securities law). It may affect the entity’s tax status if it changes the capital structure (tax law). And by itself it changes no holdings: the beneficial ownership analysis arrives with each issuance the authorization enables. One action carries obligations of its own and sets up the obligations of the issuances that follow.

A system that treats an authorized shares increase as “update a number in the cap table” will miss most of this. A system that treats it as a typed state transition – a specific variant carrying the new total, the per-share-class changes, the voting rights implications, and the linkage to the governance decision that authorized it – can activate the correct compliance domains for each aspect of the action.

The representation must therefore be a discriminated union: a closed set of action types, each carrying exactly the fields relevant to that type. A split carries its ratio and record date. A dividend carries amount, currency, and record date. An authorized shares change carries per-class deltas and the new total. The action type determines which fields exist, what they mean, and – together with the instrument class – which compliance domains the action activates. An action type outside the set is refused, exactly as an instrument class outside the taxonomy is.

The multi-domain evaluation

This brings us back to the opening claim: capital formation events touch multiple compliance domains at once, and the evaluation must reflect all of them.

When a share issuance is submitted, the compliance evaluation is a vector of checks across every applicable domain: the four from the opening – securities registration or exemption, corporate governance authorization, tax treatment, beneficial ownership thresholds – plus anti-money-laundering screening of the funds, sanctions verification of the parties, and whatever further domains the entity’s home jurisdiction attaches.

Each domain produces its own determination: compliant, non-compliant, pending, exempt, or not applicable. The set of determinations forms a compliance vector – one entry per domain. This vector is one row of the entity’s compliance passport – the append-only record of every evaluation the entity has undergone – the row that records this action.

Which domains an event activates – which entries of the vector are live – is a function of the instrument class and the action, and the activation map below is indexed by both. Each row is one action against the class or classes it names from the taxonomy above, and the rows are grouped by action so that a class reads against its neighbors; where a row names two classes or reads “shares, any class”, the share class does not move the domain set for that action, and the authorized shares increase names no class because it touches no instrument. The map is representative rather than statutory: every threshold, exemption, and condition inside a cell is a jurisdiction parameter. What the table asserts is the shape. A filled circle marks a domain the event always activates; an open circle marks conditional activation, dependent on the charter, the regime, the consideration given, or whether an offering follows; a dash marks a domain the event does not itself activate – in the anti-money-laundering column, an event in which no funds move, because where money moved earlier the diligence attached to the event that moved it.

Three facts about this map carry the argument. First, the class axis is live: fix the action and vary the class, and the domain set moves. A grant of restricted stock and a grant of an option are the same act under the same equity plan, but restricted stock is outstanding stock from the day of grant, so the tax domain evaluates at grant – the holder’s election to be taxed on the grant-date value falls due thirty days after grant under the United States rule – and the shares count toward the ownership thresholds at once, while an option grant activates both domains only conditionally. An issuance of shares for new money and an issuance of a convertible note for new money are the same act with different paper, and the note, carrying no present ownership, drops the beneficial-ownership column to conditional until it converts. Second, every event that names a counterparty activates at least five domains, outright or conditionally: multi-domain evaluation is the normal condition of capital events, not an occasional complication. Third, the sanctions column is filled on every row that has a counterparty, and it is the only fail-closed column.

That is the asymmetry. Sanctions is fail-closed once applicability is resolved, and applicability has two sources, the list and the record: the party’s own presence on a list, and the aggregate interest that blocked persons hold in the party, computed on the ownership graph from attested holdings as described above, which blocks an unlisted party by operation of law. Licenses, humanitarian carveouts, and sovereign exemptions then enter the sanctions evaluation before it returns its verdict, and an issuance whose beneficiary that verdict finds non-compliant does not proceed, regardless of how clean every other entry in the vector is. The asymmetry reflects the legal structure. Every other domain in the vector leaves the cure in the parties’ hands: a defective corporate act is ratified (Delaware General Corporation Law § 204), an unregistered offering is remedied by a rescission offer, a missed ownership filing is made late, a tax position is amended. Sanctions does not. Under United States law, civil liability for a prohibited transaction attaches without regard to knowledge or intent (50 U.S.C. § 1705(b) carries no such element; § 1705(c) reserves willfulness for the criminal penalty), and a transfer of blocked property in violation of the regulations is null and void from the moment it occurs. Only the authority can relieve that consequence afterward, by license or on an innocent holder’s prompt report; the parties cannot (31 C.F.R. § 594.202(a), (c), and (d), stated for one program and carried by each). Disclosure afterward mitigates the penalty; it does not undo the violation. A domain in which liability attaches without intent and a completed violation lies beyond the parties’ cure must be satisfied before the write, and that is what fail-closed means here.

The evaluation binds at the moment the action becomes binding. The governance decision that authorizes the issuance carries the full multi-domain verdict: without the verdict there is no authorization. The record write that follows runs under the one fail-closed check – sanctions – and appends its audit entry in the same transaction as the record itself, so every record is linked through the audit trail to the verdict that authorized it.

A share issuance that passes evaluation today might fail tomorrow if the entity’s tax status changes, and an issuance that fails today might succeed after the entity remediates the deficiency. This is correct behavior. The evaluation reflects the compliance reality at the moment of authorization, not at some earlier or later point.

The fund administration dimension

Capital formation does not end at the cap table. Fund administration faces the same structure under different specific rules.

A company raising capital through a SAFE faces securities compliance on the SAFE terms, tax compliance on the investment structure, corporate governance compliance on the company’s authority to accept investment, and beneficial ownership compliance on the resulting ownership changes. A fund raising capital through a subscription agreement for limited partnership interests faces the same domains with different specifics. A capital call from a fund to its limited partners triggers payment obligations with their own compliance surface.

This creates a three-level hierarchy of typed state machines. The fundraiser has a lifecycle that runs from draft through active to closed. The investment inside it has a payment lifecycle: pending, partially paid, paid, refunded, rejected. The capital call inside the investment is issued, then partially paid, paid, or cancelled. Each level has its own invariants, its own transition rules, and its own compliance domains.

All three levels are modeled with the same tools: typed enumerations for states, exhaustive matching for transitions, conservation invariants for the amounts, and multi-domain evaluation for every state change. The fund is a different instantiation of the same pattern: economic state with conservation laws, typed transitions, and multi-domain compliance.

Forward compatibility

The taxonomy of share classes, security types, corporate actions, and investment types will grow. Legislatures will create new instrument types. Regulators will define new categories. Markets will invent new structures.

The boundary discipline stated above – an instrument that matches no known type is refused – is also the growth policy. Extending the taxonomy is a deliberate act: the new type enters with its compliance characteristics defined, its rows in the activation map filled in, one per action it admits, and its lifecycle stated, before the first instrument of that type is accepted. A system that must take custody of an instrument ahead of its classification has exactly one honest option: suspend the operation and hold it open until a person with authority classifies the instrument. It can never proceed under a default, because class and action determine which domains activate, and an unclassified instrument therefore has no defined evaluation to pass.

The cost of this discipline is that new instrument types wait for classification. The return is that every instrument in the record has a class, every class has its activation rows, and the evaluation is total over everything the system holds.

Why the capital record must be exact before it is evaluated

A single share issuance touches securities law, corporate law, tax law, and beneficial ownership law simultaneously. A single fund investment touches all of those plus the regime governing the fund structure. Laid out across classes and events, the activation map is a matrix, and every filled cell is an evaluation computed against the record.

That dependency organizes this note. A capital formation event triggers a multi-domain evaluation, updates a conservation system, appends to a transfer log, moves a derived ownership graph, and produces immutable audit records. Recording the row is the least of it – and everything else consumes the row. The conservation constraints, the share class taxonomy, the security lifecycle, the transfer log and its derived graph, the corporate action union, the fund hierarchy: these are the typed foundations that give the evaluation something trustworthy to evaluate. With them, the evaluation produces determinations that are correct at the moment they are made and checkable after the fact by anyone who walks the audit trail.

Limitations

This note fixes the record and the activation map; it does not supply the content of any domain’s rules. What counts as an exempt offering or a taxable event is the subject of the rule encodings themselves, and it varies by jurisdiction. The activation map is representative, not statutory: a jurisdiction can attach domains the table does not show, and the conditional cells resolve differently under different charters, regimes, and forms of consideration. Of the analyses on the derived ownership graph, the aggregate-ownership arithmetic is exact over the attested entries and enters the fail-closed sanctions evaluation as applicability; the inferred relations – control chains, concerted action – carry an error rate, and their output is a flag for evaluation, not a verdict. The guarantees claimed here are exactly the ones stated: conservation checked at every write, totality of handling over closed taxonomies, refusal of the unclassified, and an append-only history. An exact record makes correct evaluation possible; the correctness of any particular rule encoding is a separate obligation.